/
ttps_attack:T1572 × criticity:high × limpar

Resultados

6 casos · pág. 1/1

itsecurityguru.org · high

Forescout exposes ROMULUS malware delivery panel behind ClickFix campaigns and links Lorem Ipsum and Axolotl loaders to Vice Society tradecraft

Forescout's Vedere Labs has documented ROMULUS, a previously unknown malware delivery platform used in ClickFix campaigns, and new delivery techniques for loaders tied to Vice Society ransomware activity. The server hosting the ROMULUS panel was found during an incident investigation, and six IP addresses exposed the same authentication i…

thehackernews.com · high

Cyber Partisans (Partisan Zmiy) hid Vasilek backdoor in VMware Tools in two-year intrusion at Russian healthcare organization

Russian firm Solar (a Rostelecom subsidiary) reported a nearly two-year intrusion at an unnamed Russian healthcare organization, attributed to the Belarus-aligned hacktivist cluster Partisan Zmiy (Cyber Partisans). Solar found the compromise in December 2025, but the earliest signs date to early 2024. Unlike the group's usual destructive …

thehackernews.com · high

APT28 (Swallowtail) breaches NATO naval shipbuilder using HOOKEDGE backdoor and new reflective loader

Symantec reports that the Russia-linked APT28 (aka BlueDelta, Fancy Bear, Forest Blizzard), tracked by Symantec as Swallowtail, targeted entities in two NATO member states. Victims include a law enforcement agency, a naval shipbuilder and a manufacturer of military aircraft engines. In the shipbuilder intrusion in late July 2026, operator…

NightEagle (APT-Q-95) targets Russian organizations with GhostContainer Exchange backdoor and RDP tunneling

Kaspersky GERT reports that the NightEagle APT (also tracked as APT-Q-95), active since at least 2023 and previously focused on Asia, is now attacking businesses in Russia. The attackers usually gain access through compromised valid credentials on corporate VPNs, connecting from Russian IPs tied to Cloudflare WARP tunnels and from Europea…

Iranian-aligned CL-STA-1178 'Blinder Tunnel' campaign hits Iraqi critical infrastructure with trojanized Dubai Airports coding lures

Unit 42 attributes with high confidence to an Iranian state-aligned actor, tracked as CL-STA-1178, a campaign called Blinder Tunnel. In March 2026 it targeted an individual in Iraq's critical infrastructure sector, after infrastructure staging that began as early as November 2025. The actor impersonated the Dubai Airports IT department an…

cisa.gov · high

CISA and FBI #StopRansomware advisory on Gunra, a Conti-derived RaaS exploiting Fortinet and VPN flaws for double extortion

The FBI, CISA, DC3, NSA, USSS and the Republic of Korea's KNPA issued joint advisory AA26-222A on Gunra ransomware. Gunra appeared in April 2025 as a double-extortion variant derived from the leaked Conti source code. It launched a structured RaaS affiliate program in January 2026, also operating under the alias Golden Community, and recr…